CEH Rainbow Tables Practice Question
Which of the following tools is used to crack Windows LAN Manager (LM) and NTLM password hashes using rainbow tables?
⚠ Common exam trap
EC-Council often tests the distinction between tools specialized for Windows hashes (Ophcrack) versus general-purpose rainbow table tools (RainbowCrack), leading candidates to confuse the two.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ophcrack
Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It is optimized for Windows password hashes and provides an efficient time-memory trade-off by looking up hashes in sorted tables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ophcrack
Why this is correct
Ophcrack is a specialized, open-source password cracker specifically designed for Windows LM and NTLM hashes, making it the correct tool for this task. It excels by employing precomputed rainbow tables, which are large datasets of hash chains, to quickly reverse the hashing process for these particular Windows authentication hashes. This method significantly reduces the time required to find the original password compared to traditional brute-force attacks, especially for weaker LM hashes.
- ✗
Hashcat
Why it's wrong here
Hashcat is a highly efficient, multi-platform password recovery tool that leverages GPU acceleration to crack a vast array of hash types using various attack modes, including brute-force, dictionary, mask, and hybrid attacks. While it can certainly crack Windows LM and NTLM hashes, it does so by generating and comparing candidate passwords against the provided hashes, not by directly utilizing precomputed rainbow tables as its primary method. Its strength lies in its speed and versatility across numerous hashing algorithms.
- ✗
John the Ripper
Why it's wrong here
John the Ripper (JtR) is a powerful and versatile password cracker capable of detecting weak passwords across many operating systems and hash types through various attack modes, such as dictionary attacks, brute-force, and single crack mode. While it can effectively crack Windows LM and NTLM hashes, it primarily operates by generating candidate passwords and hashing them on-the-fly for comparison against the target hash. Unlike Ophcrack, JtR does not inherently rely on or come bundled with precomputed rainbow tables for its cracking process.
- ✗
Hydra
Why it's wrong here
Hydra is a robust network login cracker designed to perform brute-force and dictionary attacks against numerous network services and protocols, such as SSH, FTP, HTTP, and SMB. Its purpose is to guess usernames and passwords by attempting to log in directly to these services, making it an online attack tool. Hydra does not function as an offline hash cracker, nor does it utilize or process rainbow tables to decrypt hashes; it focuses on authenticating against live network endpoints.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester wants to crack Windows NTLM hashes using rainbow tables. Which tool is specifically designed for this purpose?
medium- A.Hashcat
- B.John the Ripper
- ✓ C.RainbowCrack
- D.Ophcrack
Why C: RainbowCrack is specifically designed for cracking hashes using precomputed rainbow tables. It works by performing a lookup in a rainbow table to reverse a hash into its plaintext, which is the core mechanism described in the question. While Hashcat and John the Ripper can also crack NTLM hashes, they are not specifically designed for rainbow table attacks; they primarily use brute-force or dictionary-based methods.
Variation 2. Which of the following tools is specifically designed to perform password cracking using rainbow tables?
medium- A.John the Ripper
- B.Ophcrack
- ✓ C.RainbowCrack
- D.Hashcat
Why C: RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.